Security researchers disclosed a software supply-chain attack on November 9, 2026, affecting Ethersphere’s Bee JavaScript client and Swarm Desktop application. The compromised releases, @ethersphere/bee-js version 13.3.0 and Swarm Desktop version 0.56.2, contained malware capable of stealing cryptocurrency wallet information and establishing persistent remote access on Windows, Linux, and macOS systems. GitHub classified the affected Bee JS package as malware and warned that systems running the compromised version should be considered fully compromised.
MALWARE TARGETS CRYPTOCURRENCY WALLETS AND SYSTEM CREDENTIALS
Researchers at StepSecurity and SafeDep discovered that the malicious Bee JS package executed an npm post-installation script that downloaded and ran attacker-controlled JavaScript. The malware targeted Swarm wallet files, API keys, developer credentials, and other sensitive information while attempting to establish remote access through cross-platform backdoors. Swarm Desktop 0.56.2 contained a similar malicious loader that activated when the application launched. Investigators also discovered that the compromised package was published through Ethersphere’s legitimate GitHub Actions workflow with valid npm provenance, demonstrating how attackers can exploit trusted software-release processes to distribute malware.
SECURITY TEAMS URGED TO ISOLATE COMPROMISED SYSTEMS
Organizations using the affected versions should immediately identify compromised installations, isolate impacted devices, and rebuild systems from trusted images. Security teams should rotate exposed credentials, replace cryptocurrency wallet keys, and transfer potentially affected funds to newly secured wallets. Researchers identified Bee JS 13.2.0 and Swarm Desktop 0.56.1 as the last known clean versions, although downgrading alone cannot eliminate an established infection. The initial intrusion method, total number of victims, and financial losses remain unconfirmed. The incident highlights the importance of strengthening software-release security, restricting automated publishing permissions, and requiring code reviews before distributing trusted packages.